Image processing apparatus, encrypted job execution method thereof, and recording medium

The present invention relates to an image processing apparatus such as an image forming apparatus that receives a job including an encrypted target data piece transmitted from a user terminal connected to a network, decrypts the target data piece, and executes the job about the decrypted target data piece; an encrypted job execution method of the image processing apparatus; and a computer readable recording medium having a job execution program recorded therein to make a computer of the image processing apparatus implement the encrypted job execution method.

Conventionally, there has been known a technology to encrypt a target data piece included in a job from a security point of view, by using an external recording medium holding a public key and a secret key and having the function for decrypting data with this secret key, when the job is transmitted to an image processing apparatus, such as a MFP (Multi Function Peripheral) that is a multifunctional digital machine, from a personal computer (hereinafter will be referred to as “PC”) that is a user (client) terminal connected to a network.

To explain in other words, different shared keys are generated for respective data pieces by the PC. And a target data piece is encrypted with its shared key and this shared key is encrypted with a public key of the external recording medium. The encrypted target data piece and shared key are transmitted to the image processing apparatus. When the recording medium is connected to the image processing apparatus receiving the encrypted target data piece and shared key, the encrypted shared key is decrypted by the external recording medium with a secret key thereof. With this decrypted shared key, the target data piece is decrypted, and then the job is executed.

This technology appears in concrete form in Japanese Unexamined Laid-open Patent Publication No. 2005-348250, as follows. An image processing apparatus encrypts a target data piece with a shared key, encrypts this shared key with a public key, and stores the encrypted target data piece and shared key with their connection. When the job data is printed out, the encrypted shared key is transmitted to an IC card holding a secret key, and the shared key decrypted with this secret key is obtained therefrom. With this decrypted shared key, the encrypted job data is decrypted.

Problem to be Solved by the Invention

However, in the conventional technologies described above, an encrypted shared key of a job received by the image processing apparatus, is decrypted with a secret key of the external recording medium, and with this decrypted shared key, an encrypted print data piece is decrypted, then the job is executed, and this sequence is repeated about each job. Therefore, when a user intends to transmit a plurality of jobs to the image processing apparatus to make them executed thereby, he/she is not supposed to remove the external recording medium from the image processing apparatus, until an encrypted shared key of the last job is decrypted with the secret key. This could make the connecting time of the external recording medium comparatively longer.

As a specific example thereof, paper is supplied without removing the external recording medium if a paper-out occurs while a plurality of print jobs are being executed. This could cause a theft of the external recording medium or others.

It is an object of the present invention to provide an image processing apparatus capable of ensuring security by shortening the connecting time of an external recording medium when a plurality of jobs including target data pieces encrypted with shared keys and the shared keys encrypted with a user's public key are executed.

It is another object of the present invention to provide an encrypted job execution method implemented by the image processing apparatus.

It is yet another object of the present invention to provide a computer readable recording medium having an encrypted job execution program recorded therein to make a computer of the image processing apparatus implement the encrypted job execution method.

Means for Solving Problem

According to a first aspect of the present invention, an image processing apparatus includes:

a job receiver that receives a job including a target data piece encrypted with a shared key and the shared key encrypted with a user's public key, which is transmitted by the user via a terminal connected to a network; a job storage that stores the received job in itself; an encrypted shared key extractor that extracts from the plurality of target jobs stored in the job storage, the encrypted shared keys included in the respective target jobs; an external recording medium connector that removably connects to an external recording medium holding the user's public key and a secret key in itself and having the function for decrypting the encrypted shared key with the secret key; a decrypted shared key obtainer that transmits the plurality of encrypted shared keys extracted by the shared key extractor from the respective jobs, to the external recording medium connected to the external recording medium connector, and in return, obtains from the external recording medium, the plurality of shared keys decrypted with the secret key; a target data decryption portion that decrypts the target data pieces with their matching decrypted shared keys, after completely obtaining the plurality of decrypted shared keys from the external recording medium; and a job executor that executes the jobs including the decrypted target data pieces.

According to a second aspect of the present invention, an encrypted job execution method of an image processing apparatus includes:

receiving a job including a target data piece encrypted with a shared key and the shared key encrypted with a user's public key, which is transmitted by the user via a terminal connected to a network; storing the received job in a job storage; extracting from the plurality of target jobs stored in the job storage, the encrypted shared keys included in the respective target jobs; transmitting the plurality of encrypted shared just extracted from the respective jobs, to an external recording medium holding the user's public key and a secret key in itself and having the function for decrypting the encrypted shared key with the secret key, which is removably connected to an external recording medium connector, and in return, obtaining from the external recording medium, the plurality of shared keys decrypted with the secret key; decrypting the target data pieces with their matching shared keys, after completely obtaining the plurality of decrypted shared keys from the external recording medium; and executing the jobs including the decrypted target data pieces by a job executor.

According to a third aspect of the present invention, a computer readable recording medium having an encrypted job execution program recorded therein to make a computer of an image processing apparatus execute:

receiving a job including a target data piece encrypted with a shared key and the shared key encrypted with a user's public key, which is transmitted by the user via a terminal connected to a network; storing the received job in a job storage; extracting from the plurality of target jobs stored in the job storage, the encrypted shared keys included in the respective target jobs; transmitting the plurality of encrypted shared just extracted from the respective jobs, to an external recording medium holding the user's public key and a secret key in itself and having the function for decrypting the encrypted shared key with the secret key, which is removably connected to an external recording medium connector, and in return, obtaining from the external recording medium, the plurality of shared keys decrypted with the secret key; decrypting the target data pieces with their matching shared keys, after completely obtaining the plurality of decrypted shared keys from the external recording medium; and executing the jobs including the decrypted target data pieces by a job executor.

FIG. 1 This is a view showing an entire configuration of an image processing system in which an image forming apparatus according to one embodiment of the present invention is employed.

FIG. 2 This is a block diagram showing an electrical configuration of the image forming apparatus of FIG. 1 .

FIG. 3 This is a block diagram showing an electronic configuration of an external recording medium.

FIG. 4 This is a plain view of an operation panel of the image forming apparatus.

FIG. 5 This is a view showing an example of a job transmitted from a client PC.

FIG. 6 This is a view showing an example of a job administration table.

FIG. 7 This is a flowchart representing a procedure executed in the client PC.

FIG. 8 This is a flowchart representing a procedure executed in the image forming apparatus.

FIG. 9 This is a view showing a job administration table after the job administration table of FIG. 6 is updated.

FIG. 10 This is a flowchart representing a procedure that is executed in the image forming apparatus in another embodiment of the present invention.

FIG. 11 This is a view showing a job administration table updated in the embodiment of FIG. 10 .

FIG. 12 This is a plain view of the operation panel of the image forming apparatus, displaying a message in the embodiment of FIG. 10 .

FIG. 13 This is a flowchart representing a procedure that is executed in the image forming apparatus in yet another embodiment of the present invention.

FIG. 14 This is a view showing a job administration table updated in the embodiment of FIG. 13 .

FIG. 15 This is a flowchart representing a procedure that is executed in the client PC in still yet another embodiment of the present invention.

FIG. 16 This is a view showing an example of a job transmitted from the client PC;

FIG. 17 This is a flowchart representing a procedure that is executed in the image forming apparatus in the embodiment of FIG. 15 .

FIG. 18 This is a view showing an example of a job administration table in the embodiment of FIG. 15 .

FIG. 19 This is a view showing a job administration table updated in the embodiment of FIG. 15 .

Hereinafter, one embodiment of the present invention will be described with reference to Figures.

FIG. 1 is a view showing a configuration of an image processing system in which an image processing apparatus according to a first embodiment of the present invention is employed.

As shown in FIG. 1 , this image processing system includes an image forming apparatus 1 as the image processing apparatus, a client PC 2 as an external terminal, and an external recording medium 3 capable of connecting to the image forming apparatus 1 and the client PC 2 . And the image forming apparatus 1 and the client PC 2 are interconnected via a network 4 .

In this embodiment, as the image forming apparatus 1 , a MFP that is a multifunctional digital machine collectively having the copy function, the print function, the scan function, the facsimile function and other functions, is employed as described above. And in this embodiment, the jobs are print jobs for example, and not limited to print jobs. Alternatively, the jobs may be facsimile transmission jobs, data transmission jobs and other jobs.

When a user intends to have the image forming apparatus 1 execute a print job, he/she connects to the client PC 2 , the external recording medium 3 that is a portable recording medium such as a USB memory, and specifies the image forming apparatus 1 .

The client PC 2 generates a shared key and encrypts with this shared key, a print data piece that is a target data piece included in the print job. In the case of a plurality of print jobs, the client PC 2 generates different shared keys for the respective print jobs. Subsequently, this generated shared key is encrypted with a public key held by the external recording medium 3 , and user information is given to the encrypted print data piece. And as shown in FIG. 5 , the encrypted print data piece, the encrypted shared key and the not encrypted user information are consolidated into one print job and transmitted to the image forming apparatus 1 . Here, the user information specifies a user (User A, in this example).

FIG. 2 is a block diagram showing an electrical configuration of the image forming apparatus 1 .

As shown in FIG. 2 , the image forming apparatus 1 includes a CPU 11 , an external recording medium interface (IF) 12 , an external recording medium controller 13 , a shared key controller 14 , a network interface (IF) 15 , an operation panel 16 , a ROM 17 , a job administrator 18 , an authenticator 19 , a RAM 20 , and a memory 21 .

The CPU 11 centrally controls all operations of the image forming apparatus 1 .

The external recording medium IF 12 is a connecter to which the external recording medium 3 is removably connected.

The external recording medium controller 13 has the function for transmitting an encrypted shared key to the external recording medium 3 connected to the external recording medium IF 12 and the function for receiving a shared key decrypted by the external recording medium 3 .

The network IF 15 exchanges data with external apparatuses via the network 4 . In this embodiment, it serves as a job receiver that receives a job transmitted from the client PC 2 .

The operation panel 16 includes an entry portion 16 a and a display 16 b . As shown in FIG. 4 , the entry portion 16 a includes various keys such as numeric keys and a start key, and it is used to enter a user name, a password and others. The display 16 b displays on itself, a permission to remove the external recording medium 3 , entered information such as a user name and a password, a result of operation, and etc. In this embodiment, it is constructed of a liquid crystal display with touch panel functionality, for example.

The ROM 17 is a memory that stores in itself, an operation program for the CPU 11 and other data.

The job administrator 18 creates an administration table shown in FIG. 6 when receives a job from the client PC 2 , and performs various administration operations about the received job.

In the administration table of FIG. 6 , there are columns titled as “user information”, “print data encrypted with shared key”, “shared key” and “whether or not shared key is encrypted with public key”, and those information are recorded for each job.

The authenticator 19 performs authentication to judge whether or not to permit a user who intends to use the image forming apparatus 1 , to perform operations.

The RAM 20 provides an operation area for the CPU 11 to execute processing according to an operation program stored in the ROM 17 .

The memory 21 is constructed of a nonvolatile recording medium such as a hard disk drive (HDD), and stores in itself data included in jobs, the job administration table of FIG. 6 , various applications, and etc. A configuration may be employed, wherein the memory 21 holds an area called as a “Box” to store only the jobs including target data pieces encrypted with shared keys, and only the jobs including encrypted data pieces are collectively stored in this area.

FIG. 3 shows a block diagrams showing en electrical configuration of the external recording medium 3 .

As shown in FIG. 3 , this external recording medium 3 includes a CPU 31 , a connector 32 , a shared key controller 33 , a user information administrator 34 , a memory 35 , a public key controller 36 and a secret key controller 37 .

The CPU 31 centrally controls all operations of the external recording medium 3 .

The connector 32 recognizes the external recording medium 3 as being connected to the client PC 2 or the image forming apparatus 1 , and being removed therefrom.

When the external recording medium 3 is connected to the client PC 2 , the shared key controller 33 receives a shared key generated by the client PC 2 and transmits it to the public key controller 36 , and then transmits to the client PC 2 , the shared key encrypted with a public key by the public key controller 36 . Meanwhile, when the external recording medium 3 is connected to the image forming apparatus 1 , it receives an encrypted shared key from the image forming apparatus 1 and transmits it to the secret key controller 37 , and then transmits to the image forming apparatus 1 , the shared key decrypted with a secret key by the secret key controller 37 .

The user information administrator 34 administers user names, passwords and others.

The memory 35 records in itself users' public keys, secret keys, user names, passwords and others.

The public key controller 36 encrypts with a public key, a shared key received from the client PC 2 . The secret key controller 37 decrypts with a secret key, an encrypted shared key received from the image forming apparatus 1 .

Hereinafter, procedures will be explained, wherein a job including a print data piece encrypted by the client PC 2 and others is generated and transmitted to the image forming apparatus 1 , then the received print job is executed by the image forming apparatus 1 .

Initially, a procedure executed in the client PC 2 will be explained with reference to a flowchart shown in FIG. 7 .

A user connects the external recording medium 3 to the client PC 2 . Then in Step S 1 , in the client PC 2 , a user name and a password are obtained from the external recording medium 3 connected thereto, and user authentication is performed.

In Step S 2 , it is judged whether user authentication succeeds or fails. If user authentication fails (NO in Step S 2 ), the routine immediately terminates. If user authentication succeeds (YES in Step S 2 ), the user's selecting the image forming apparatus 1 (referred to as “MFP” in Figure) and giving an execution instruction by pressing the execute button, are accepted in Step S 3 .

Then in Step S 4 , in the client PC 2 , a shared key is generated and a print data piece is encrypted with this shared key. And the shared key is transmitted to the external recording medium 3 , in Step S 5 .

In the external recording medium 3 , the shared key received from the client PC 2 is encrypted with this user's public key held by the external recording medium 3 itself. And then, this encrypted shared key is returned to the client PC 2 .

In Step S 6 , in the client PC 2 , the user information, the print data piece encrypted with the shared key and the shared key encrypted with the user's public key are consolidated into one job, and the job is transmitted to the image forming apparatus 1 . Then the routine terminates.

FIG. 8 is a flowchart representing a procedure executed in the image forming apparatus 1 . This procedure is executed by the CPU 11 according to an operation program recorded in a recording medium such as the ROM 17 .

In the image forming apparatus 1 receiving the job from the client PC 2 , information of the job is recorded in the job administration table shown in FIG. 6 .

A user connects the external recording medium 3 to the external recording medium IF 12 . Then in Step S 11 of FIG. 9 , in the image forming apparatus 1 , a user name and a password are obtained from the external recording medium 3 connected to the external recording medium IF 12 , and user authentication is performed. Alternatively, user authentication may be performed based on a user name and a password entered by the user via the operation panel 16 .

In Step S 12 , it is judged whether user authentication succeeds or fails. If user authentication fails (NO in Step S 12 ), the routine immediately terminates. If user authentication succeeds (YES in Step S 12 ), the routine proceeds to Step S 13 .

In Step S 13 , it is judged whether or not there exists a shared key encrypted with this authenticated user's pubic key, in the job administration table. If there exists a shared key encrypted with the user's public key, in the job administration table (YES in Step S 13 ), then in Step S 14 , in the image forming apparatus 1 , the shared key encrypted with the user's public key is extracted from the job administration table and transmitted to the external recording medium 3 . As described above, a job of an authenticated user is automatically extracted among the target jobs, and an encrypted shared key included in the extracted job is automatically obtained, which would save users the trouble of having to select a target job.

In the external recording medium 3 receiving the encrypted shared key, the encrypted shared key is decrypted with a secret key and this decrypted shared key is returned to the image forming apparatus 1 .

In Step S 15 , in the image forming apparatus 1 , the decrypted shared key is received and the job administration table is updated as shown in FIG. 9 . And then, the routine goes back to Step S 13 and repeats Steps S 13 through S 15 . In this way, if there exist a plurality of jobs of the same user in the job administration table, shared keys encrypted with this user's public key, are extracted from all the jobs and transmitted to the external recording medium 3 . Then the decrypted shared keys are received (obtained) and the job administration table is updated.

As shown in the updated job administration table of FIG. 9 , the “print data A 001 encrypted with shared key” and the “print data A 002 encrypted with shared key” are included in the job records of User A. As for the both records, the data in the column “shared key: encrypted/not encrypted with public key” are changed from “encrypted” to “not encrypted”. When execution of these jobs is completed, the job records are removed from the job administration table.

If all the encrypted shared keys of the user are decrypted and the job administration table is updated (NO in Step S 13 ), then in Step S 16 , in the image forming apparatus 1 , a message is displayed on the display 16 b of the operation panel 16 , as “now you can remove the external recording medium 3 ”, as shown in FIG. 4 . Thus, the user is allowed to remove the external recording medium 3 .

Then in Step S 17 , it is judged whether or not there exists any job in the job administration table. If there exists any job in the job administration table (YES in Step S 17 ), the print data piece is decrypted and printed out in Step S 18 . And then, the routine goes back to Step S 17 and the decryption and print operations are repeated until there exists no job of the user in the job administration table.

If there exists no job of the user in the job administration table (NO in Step S 17 ), the routine terminates.

As described above, when a plurality of jobs of a specific user, existing in the job administration table, are executed, encrypted shared keys are extracted from the plurality of jobs. And all these shared keys are decrypted by the external recording medium, and after that, the target data pieces are also decrypted. This means, once all the decrypted shared keys have been obtained from the external apparatus 3 , the external recording medium 3 can be removed anytime, which would shorten the connecting time of the external recording medium 3 . Therefore, it is only necessary for the user to remove the external recording medium 3 , after all the plurality of decrypted shared keys are completely obtained from the external recording medium 3 . That could eliminate the possibility that the external recording medium 3 is stolen during supplement of paper when a paper-out occurs during execution of print jobs, and ensure higher security.

Hereinafter, another embodiment of the present invention will be explained.

In the embodiment previously explained, a message telling that the external recording medium 3 can be removed is displayed on the operation panel 16 , in Step S 16 . However, seeing this message, the user possibly removes the external recording media 3 from the image forming apparatus 1 and gets off the image forming apparatus 1 for a while, before the print data is printed out. If it is printed out in this state of things, there is a possibility that the printed content is leaked to third persons. The embodiment to be explained below is suggested to take measures to meet the situation.

A procedure executed in the image forming apparatus 1 in this embodiment will be described with reference to a flowchart shown in FIG. 10 . This procedure is executed by the CPU 11 according to an operation program recorded in a recording medium such as the ROM 17 .

In the image forming apparatus 1 receiving the job from the client PC 2 , information of the job is registered n the job administration table of FIG. 6 .

In this state of things, the external recording medium 3 is connected to the external recording medium IF 12 . Then in Step S 21 of FIG. 10 , in the image forming apparatus 1 , a user name and a password are obtained from the external recording medium 3 connected to the external recording medium IF 12 , and user authentication is performed based on the user information of FIG. 5 , recorded in the memory 21 of the image forming apparatus 1 .

In Step S 22 , it is judged whether user authentication succeeds or fails. If user authentication fails (NO in Step S 22 ), the routine immediately terminates. If user authentication succeeds (YES in Step S 22 ), the routine proceeds to Step S 23 .

In Step S 23 , it is judged whether or not there exists any shared key encrypted with this authenticated user's public key, in the job administration table. If there exits any shared key encrypted with the user's public key, in the job administration table (YES in Step S 23 ), then in Step S 24 , in the image forming apparatus 1 , the shared keys encrypted with the user's public keys are extracted from the job administration table and transmitted to the external recording medium 3 .

In the external recording medium 3 receiving the encrypted shared keys, the respective encrypted shared keys are decrypted with a secret key and these decrypted shared keys are returned to the image forming apparatus 1 .

In Step S 25 , in the image forming apparatus 1 , the decrypted shared key is received and the job administration table is updated as shown in FIG. 11 . And then, the routine goes back to Step S 23 and repeats Steps S 23 through S 25 .

As shown in the updated job administration table of FIG. 11 , there is a column titled as “print data: encrypted/not encrypted with shared key”. As for the job records of User A, including the “print data A 001 ” and the “print data A 002 ”, the data in the column “print data: encrypted/not encrypted with shared key” is still “encrypted”, at this stage.

If all the encrypted shared keys of the user are decrypted and the job administration table is updated (NO in Step S 23 ), then in Step S 26 , a message is displayed on the display 16 b of the operation panel 16 , as “now you can remove the external recording medium 3 . If you do so, please note that we will print later when the external recording medium 3 is reconnected”, as shown in FIG. 12 . Alternatively, a message may be displayed thereon as “we will print later when the external recording medium 3 is reconnected”, when the external recording medium 3 is detected as being removed.

Then in Step S 27 , it is judged whether or not there exists any “not decrypted” print data piece of the user, in the job administration table. If there exists any “not decrypted” print data piece of the user (YES in Step S 27 ), the routine proceeds to Step S 28 .

In Step S 28 , in the image forming apparatus 1 , the print data piece of the user, existing in the job administration table, is decrypted and the job administration table is updated by changing the data in the column “print data: encrypted/not encrypted with shared key” from “encrypted” to “not encrypted”, as shown in FIG. 11 . And then, the routine goes back to Step S 27 .

If there exists no “not decrypted” print data piece of the user (NO in Step S 27 ), then it is judged in Step S 29 , whether or not the user's external recording medium 3 is still connected. If the user's external recording medium 3 is not connected any more (NO in Step S 29 ), the routine terminates. Thus, when the external recording medium 3 is removed, the print data pieces are decrypted but not printed out. If the user's external recording medium 3 is still connected (YES in Step S 29 ), the routine proceeds to Step S 30 .

In Step S 30 , it is judged whether or not there exists any decrypted print data piece of the user, in the job administration table. If there exists (YES in Step S 30 ), the print data piece is printed out in Step S 31 . And then, the routine goes back to Step S 29 and repeats Steps S 29 through S 31 until all the print data pieces of the user, existing in the job administration table, are printed out.

If there exists no print data piece of the user in the job administration table (NO in Step S 30 ), the routine terminates.

As described above, in this embodiment, if the external recording medium 3 is removed after completely obtaining the plurality of decrypted shared keys from the external recording medium 3 and before printing out the print data pieces, the print data pieces are only decrypted with their shared keys, and then properly printed out later when the external recording medium 3 is reconnected. Therefore, for example, even if the user removes the external recording medium 3 and gets off the image forming apparatus 1 for a while, the possibility that the printed content is leaked to third persons can be eliminated and higher security can be ensured.

Hereinafter, yet another embodiment of the present invention will be explained. In the embodiment previously explained with FIG. 10 , if the external recording medium 3 is removed after completely obtaining the plurality of decrypted shared keys from the external recording medium 3 and before printing out the print data pieces, the print data pieces are properly printed out later when the external recording medium 3 is reconnected. However, there is a possibility that the decrypted print data pieces are leaked, if the waiting time for reconnection is too long.

To take measures, in the embodiment to be explained below, if there exists a print job not executed yet at a time when a predetermined time has elapsed after the target data piece is decrypted, the print job is discarded.

A procedure executed in the image forming apparatus 1 in this embodiment will be described with reference to a flowchart shown in FIG. 13 . This procedure is executed by the CPU 11 according to an operation program recorded in a recording medium such as the ROM 17 . As referred to FIG. 13 , some Steps are exactly the same as those of FIG. 10 , thus the same Step numbers S 21 through S 31 are given to the same Steps, respectively, and detailed explanation thereof will be omitted.

In Step S 29 , it is judged whether or not the user's external recording medium 3 is still connected. If the user's external recording medium 3 is not connected any more (NO in Step S 29 ), then it is judged in Step S 32 , whether or not there exists in the job administration table, any print data piece of the user with a time over Time T that is the predetermined time elapsing after the print data piece is decrypted with a shared key.

Referring to the job administration table of FIG. 14 , there is a column titled as “time elapsing from decrypting print data with shared key (seconds)”. As for the job records of User A, including “print data A 001 ” and “print data A 002 ”, the time elapsing from decryption are “600 (seconds)” and “660 (seconds)”, respectively.

If there exists no print data piece of the user with a time over Time T (YES in Step S 32 ), the routine goes back to Step S 29 . If there exists a print data piece of the user with a time over Time T, then in Step S 33 , the print data piece of the user with a time over Time T that is the predetermined time elapsing after the print data piece is decrypted with a shared key, is removed (discarded) from the job administration table. Then, the routine goes back to Step S 29 .

As described above, in this embodiment, an unexecuted print job with a time over a predetermined time elapsing from decryption of its print data piece, is discarded. That could eliminate the possibility that the print data piece is leaked if the print job is not executed and thereby the print data piece is unfavorably kept in the image forming apparatus 1 for a long time, and ensure higher security.

Hereinafter, still yet another embodiment of the present invention will be explained. In this embodiment, in addition to an encrypted print data piece and a shared key, a job includes job spec information indicating types of job, encrypted with a shared key. The image forming apparatus 1 decrypts job spec information before decrypting target data pieces, and preferentially decrypts a target data piece of a specific type of job among the types of job indicated by the decrypted job spec information, and then executes the specific type of job.

A procedure executed in the client PC 2 in this embodiment will be explained with reference to a flowchart shown in FIG. 15 . In this example, the types of job are “print” and “store in Box”, but the types of job are not limited thereto.

A user connects the external recording medium 3 to the client PC 2 . Then in Step S 61 , in the client PC 2 , a user name and a password are obtained from the external recording medium 3 connected thereto, and user authentication is performed using them.

In Step S 62 , it is judged whether user authentication succeeds or fails. If user authentication fails (NO in Step S 62 ), the routine immediately terminates. If user authentication succeeds (YES in Step S 62 ), the user selects the image forming apparatus 1 and gives an execution instruction by pressing the execute button, in Step S 63 .

Then in Step S 64 , in the client PC 2 , a shared key is generated and a target data piece and job spec information are encrypted with this shared key. And the shared key is transmitted to the external recording medium 3 , in Step S 65 .

In the external recording medium 3 , the shared key received from the client PC 2 is encrypted with this user's public key held by the external recording medium 3 itself. And then, this encrypted shared key is returned to the client PC 2 .

In Step S 66 , in the client PC 2 , the user information, the target data piece and the job spec information encrypted with the shared key, and the shared key encrypted with the user's public key are consolidated into one job as shown in FIG. 16 , and the job is transmitted to the image forming apparatus 1 . Then the routine terminates.

Referring to FIG. 16 , the job owner is User A, and the job spec information encrypted with the shared key is “store in Box”, the print data piece encrypted with the shared key is “A 001 ”, and the shared key encrypted the user's public key is “shared key A 001 ”.

FIG. 17 is a flowchart representing a procedure executed in the image forming apparatus 1 . This procedure is executed by the CPU 11 according to an operation program recorded in a recording medium such as the ROM 17 .

In the image forming apparatus 1 receiving the job from the client PC 2 , information of the job is registered in the job administration table, as shown in FIG. 18 .

Referring to the updated job administration table of FIG. 18 , there are columns titled as “job spec information” and “job spec information: encrypted/not encrypted with shared key”. As for all the job records here, the data in the column “job spec information: encrypted/not encrypted with shared key” is “encrypted”.

A user connects the external recording medium 3 to the external recording medium IF 12 . Then in Step S 71 of FIG. 17 , in the image forming apparatus 1 , a user name and a password are obtained form the external recording medium 3 connected to the external recording medium IF 12 , and user authentication is performed using them.

In Step S 72 , it is judged whether user authentication succeeds or fails. If user authentication fails (NO in Step S 72 ), the routine immediately terminates. If user authentication succeeds (YES in Step S 72 ), the routine proceeds to Step S 73 .

In Step S 73 , it is judged whether or not there exists any shared key encrypted with this authenticated user's public key, in the job administration table. If there exists a shared key encrypted with the user's public key, in the job administration table (YES in Step S 73 ), then in Step S 74 , in the image forming apparatus 1 , the shared key encrypted with the user's public key is extracted from the job administration table and transmitted to the external recording medium 3 .

In the external recording medium 3 receiving the encrypted shared key, the encrypted shared key is decrypted with a secret key and this decrypted shared key is returned to the image forming apparatus 1 .

Subsequently in Step S 75 , in the image forming apparatus 1 , the decrypted shared key is received, and the data in the column “shared key: encrypted/not encrypted with shared key” of the job administration table is updated as shown in FIG. 19 . And then, the routine goes back to Step S 73 and repeats Steps S 73 through S 75 .

If all the encrypted shared keys of the user are decrypted and the job administration table is updated (NO in Step S 73 ), then it is judged in Step S 76 , whether or not there exists any job of the user, including job spec information encrypted with a shared key, in the job administration table. If there exists (YES in Step S 76 ), then in Step S 77 , the job spec information is decrypted with the user's shared key, and the job administration table is updated by changing the data in the column “job spec information: encrypted/not encrypted with shared key” from “encrypted” to “not encrypted”. And then, the routine goes back to Step S 76 and repeats Step S 76 and S 77 until there exists no job of the user, including job spec information encrypted with a shared key, in the job administration table. If there does not exist any (NO in Step S 76 ), the routine proceeds to Step S 78

In Step S 78 , it is judged whether or not there exists any job of the user, including the job spec information “print”. If there exists (YES in Step S 78 ), the encrypted print data piece of the job is decrypted with the shared key and printed out, in Step S 79 . Then, the routine repeats Steps S 78 and S 79 until there exists no job of the user, including the job spec information “print”. If there does not exist any (NO in Step S 78 ), a message telling that the external recording medium 3 can be removed, is displayed on the operation panel 16 , in Step S 80 .

In this way, print jobs are preferentially executed.

Subsequently in Step S 81 , it is judged whether or not there exists any job of the user, including the job spec information “store in Box”. If there exists (YES in Step S 81 ), the encrypted store-in-Box data piece of the job is decrypted with the shared key and stored in a Box, in Step S 82 . Then, the routine repeats Steps S 81 and S 82 until there exists no job of the user, including the job spec information “store in Box”. If there does not exist any (NO in Step S 81 ), the routine terminates.

This application claims priority to Japanese Patent Application No. 2008-235630 filed on Sep. 12, 2008, the entire disclosure of which is incorporated herein by reference in its entirety.

The terms and expressions provided herein have been employed for the purpose of explaining, never for the purpose of limiting interpretation or eliminating any equivalents of the characteristic objects illustrated or described herein. It should be understood that various other modifications can be made within the range of what the present invention claims

1 Image Forming Apparatus (Image Processing Apparatus)

2 Client PC

3 External Recording Medium

4 Network

12 External Recording Medium Interface (External Recording Medium Connecter)

13 External Recording Medium Controller

14 Shared Key Controller

15 Network Interface

16 Operation Panel

17 ROM

18 Job Administrator

19 Authenticator

21 Memory